Problem list, allergies and observations (SP7)
The three chart tables where a modelling mistake harms a patient rather than annoying a user. Condition carries TWO independent statuses because conflating the...
The terminology store (SP4)
Releases, concepts, the precomputed hierarchy closure, value set definitions and expansions, concept maps, and per-tenant licence entitlement. Releases are nev...
Two-phase transaction Bundle executor (SP3)
Phase 1 resolves every conditional reference and urn:uuid placeholder and touches nothing. Phase 2 writes and reads nothing. The split is the entire point. The...
A report is a bug or an enhancement
The distinction is not cosmetic — it decides what the AI session is asked to do. Pointing a session at logs hunting a fault that was never there wastes the whol...
The FHIR search compiler (SP3)
Compiles a search into one SQL statement over the typed index tables. Every rule below fails by returning the WRONG ROWS rather than by raising anything, which ...
Stop the bug list 500ing on every unfiltered load
PostgreSQL cannot infer a type for a null parameter inside a string expression: LOWER(CONCAT('%', :search, '%')) with a null :search guessed bytea, and the list...
The FHIR read path — read, vread, history and ETag (SP3)
Completes the round trip: a resource can now be written, read back, read at a specific revision, and have its history walked. The JSON is SERVED rather than as...
The FHIR write path — projection and atomic writer (SP3)
A resource write is not one row: it is the domain rows, the canonical JSON, up to eight kinds of search-index row, a reference link per reference, and a securit...
FHIR resource repositories, with the 40001-safe version claim
claimNextVersion is an UPDATE ... SET current_version_id = current_version_id + 1 and must be the FIRST statement of a write transaction. The obvious alternativ...
Add the AiDispatchRequest the pushed code already imports
SecurityService's SystemBugAiDispatchController and SystemBugAiDispatchService are on main and import **************** but the record itself was never committed...
The encounter spine (SP5)
The entity everything clinical hangs off — a note, an order, a diagnosis and a charge all point at the encounter they arose in. Planned and actual times are se...
The Patient entity and its US Core satellites (SP5)
A new entity rather than a reuse, and each rejection is concrete rather than stylistic. Not Member: GET /api/security/members/names returns every member of an o...
The disclosure ledger and patient restrictions (SP2)
DisclosureLedger is separate from phi_access_log on purpose. The access log records every READ, and most reads are a clinician opening a chart; deriving an acco...
Care relationships and break-glass, the facts behind the access basis (SP2)
PhiAccessBasis gained CARE_TEAM and BREAK_GLASS last commit; without these two tables those values are decorative. Nothing on the platform modelled a provider-p...
Record that Java field order does not control DDL key order
The composite-key assertion passed while ddl-auto actually built PRIMARY KEY (logical_id, resource_type, tenant_id) — Hibernate emits @EmbeddedId columns ALPHAB...
DS4P security labels, applied at write time (SP2)
The indexed projection of a resource's meta.security labels, and the thing that has to exist before the first clinical read path rather than after the first beh...
Extend the audit spine for clinical accounting (SP2)
Four fields the clinical read paths cannot work without, and none of which can be backfilled — each records something only knowable at the moment of access. pu...
The eight typed search-index tables (SP3)
Search runs over explicit typed tables, not JSONB with GIN. That is forced by the database, not chosen: Yugabyte's own docs state a GIN index cannot use more th...
FHIR resource versioning and the reference-link backbone (SP3)
Three tables that between them make read, vread, _history, ETag and every form of _include work. fhir_resource_current is a pointer, one row per resource forev...
The FHIR datatype layer and its discipline harness (SP3)
The foundation every clinical entity reuses, and the build gate that stops it drifting. Both land together on purpose: a harness written before there is anythin...
Guard the last four unenforced capabilities; the baseline is now empty
SOCIAL_MESSAGING, CANVA, MCP_GATEWAY and ANALYTICS_EXPORT were each declared outside the compliance boundary, bound to no ServiceType, and checked by nothing — ...
Rights, entities, repositories and DTOs
MANAGE_SYSTEM_BUGS is a PlatformRightType and must stay one: the dispatch it a tenant administrator can edit their own organization's security models. Screensh...
Add a global alias-uniqueness check
**************** scopes by provider, and that was right while an alias was only ever resolved as (security_provider_id, alias) — the pair behind a <alias>.<pare...
Add the Affiliate Sales Scoreboard widget rights
Five rights, 234-238, in the MARKETING group and hung off VIEW_REFERRAL_CODES: a leaderboard of referral numbers is tracking-code data, and a member who may not...
Ratchet that a blocked capability with no app has a call-site guard
Splitting an app from the capability inside it is what lets a clinic hold a phone system and a video room at all, but it moves the enforcement burden. PhiModule...
The five pre-existing verticals must ship available
Shipping all six children PLANNING was wrong for five of them. RETAIL, RENTAL, SERVICE, SUBSCRIPTION and PROCUREMENT are not new functionality — they are what C...
Every vertical names its own child app
requiredService becomes total now that each vertical has a child app under ServiceType.POS, which deletes the "null means POS alone is enough" special case and ...
Cascade feature enable/disable across the app tree
Enabling a child enables its parent; disabling a parent disables every child; disabling the last child disables the parent. Enabling a parent leaves children al...
Add PhiCapabilityGuard for call-time capability checks
PhiTenantGuard runs at feature-enable time and nowhere else — three call sites, all in FeatureService. Now that PhiModule is capability-grained, an app whose co...
Split PhiModule from app-grained to capability-grained
POS mapped to ECOMMERCE_SYNC (BLOCKED_NO_BAA) and the whole commerce surface hangs off POS, so an org with handlesPhi=true could not switch commerce on at all —...
Give ServiceType a two-level parent/child tree
Six commerce children at new ids 26-31, wired to POS in a static block on the RoleRightType pattern (an enum constant cannot reference another from its own cons...
Store the type description as rich text
The description on **************** is a Lexical editor state now rather than a line of prose, so the column has to be an unbounded TEXT bound as a long varchar...
One modified record with two layers, not two records
A document had up to two derived rows — CLASSIC for edited bytes, FORM_FILLABLE for fields — and something had to decide which was based on the other, repointin...
The schema, rights and storage domain behind frame widgets
A Picture Frame is a member's own photos and videos on their own launchpad, and a member may hang several. This is everything the platform needs to hold one. P...
Model the master notes and the right that guards the org's
A master note is the one note a member — or an organisation — always has. "My Master Note" is provisioned per membership; "Our Master Note" is one per organisat...
Do not bill an org twice for a version that owns no bytes
The org storage total is SUM(fileSize) over Img rows, and a derived version points at its original's ImgDat while copying its fileSize — so every modified versi...
Split a document into its original and its modified versions
imgs.modified_kind + imgs.original_img_id. Null kind means the row IS an original — the bytes a member uploaded — which is the correct reading for every row tha...
Put the timecard widget under the HR group, like every other widget
TIMECARD_TODAY_WIDGET now hangs off MANAGE_TIMECARDS instead of being a root, so all five widgets have the identical shape the calendar ones set: a parent data ...
Restore the CRLF line endings in CalendarEventAttendeeRepository
A scripted edit rewrote the file through a text API, normalising all 62 CRLF line endings to LF and turning a 15-line addition into a 139-line diff. The content...
Three more home widgets, and the one that cannot have a parent
Unread mail hangs off ACCESS_MAIL and leads-needing-action off VIEW_LEADS, both by the same rule as the calendar widgets: a widget is gated by the right that go...
Give every home widget a five-right policy, and page the calendar for it
Ten rights arrive as two five-right blocks — one per widget — hanging off VIEW_CALENDAR, because a widget must be gated by the right that governs the data it sh...
Add the org chat policy engine
Decides whether one member may open a conversation with another, and whether they may send into one that exists. Rules are an ordered list over ordered pairs an...
Mark the member's auto-managed Selected Docs binder
binders.is_scratch flags the one binder per (owner, collection) whose documents are the DocManager grid selection rather than a curated list. It is an ordinary ...
Let a lead claim mail that predates its e-mail address
Matching is point-in-time by design — a contact point only claims traffic inside its window, so editing a lead cannot retroactively rewrite history. The cost is...
Let a manager raise a reservation for an agent
Somebody who manages opportunities can now file a reservation request on a sales agent's behalf. CreateReservationRequest carries onBehalfOfMemberId for it. Th...
Make free-for-all acceptance spendable, so it can be capped
FFA bypassed the credit system outright, which left a manager with no lever over it: Max Daily Spend sat behind if (!ffa) and could not cap an FFA product, and ...
Resolve a member's photo URL from the shared library
The Chats → Support list is about to show the requestor's face, and a support requestor is — on the platform's own desk — always somebody else's member. Every o...
Count today's spend across a member's products in one query
Manage-Credits wants to show, per member, how many leads they have accepted so far today — the running total the Max Daily Spend cap is compared against. ******...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.